Summary
Ewon remote access has three parts. An Ewon gateway (Cosy or Flexy) sits at the machine and connects outbound to Talk2M, a cloud service operated by HMS Networks. The user connects to the same service with eCatcher, a VPN client, or through M2Web in a browser. Talk2M joins the two, and the user reaches the machine's network through it.
The design solves the problem it was built for. A machine builder can reach one machine on a customer's site without asking the customer's IT for an inbound firewall rule. The security questions concern the architecture: who operates the broker, what a connected user can reach, and what is recorded. This post takes its description of how Ewon works from HMS's public documentation, linked inline. Where the documentation does not answer a question, we say so.
The three parts of Ewon remote access
The gateway at the machine
The Ewon Cosy is an industrial router installed at the machine. HMS's whitepaper Get started with industrial remote access describes it as a secure industrial router for remote connection to a machine, connecting over Ethernet, 4G or Wi-Fi. The Flexy adds data monitoring on top of remote access. HMS's Talk2M page says the remote connectivity comes from the integration between these gateways and Talk2M.
The gateway has a WAN side, toward the factory network or cellular, and a LAN side, toward the machine's PLC, HMI and other devices.
Talk2M, the cloud broker
Talk2M is the cloud service in the middle. According to the whitepaper, when the Ewon comes online it connects in three phases: it authenticates to a central access server over HTTPS, asks over HTTPS which VPN server to use (the address can change from one connection to the next), and then builds a VPN tunnel to that server.
All three phases are outbound connections. HMS's firewall requirements page says to allow outbound TCP 443 and UDP 1194 to the wildcard domain *.talk2m.com, for devices and for eCatcher. No inbound port needs to be opened at the site. This property made cloud-brokered remote access popular, and any alternative should keep it.
HMS's developer documentation adds that an Ewon gateway can instead act as an OpenVPN client to a VPN server of your own, outside Talk2M.
eCatcher and M2Web on the user's side
HMS calls eCatcher the VPN client for Talk2M. The user signs in with an account name, a user name and a password, per the whitepaper, and HMS says two-factor authentication can be set up. The user sees the Ewons they have rights to, and clicks one to connect.
The whitepaper describes what happens next: eCatcher builds a second VPN tunnel to the same Talk2M VPN server, so there are two tunnels, one from the Ewon and one from eCatcher. eCatcher adds a route on the user's PC to the Ewon's LAN range and removes it when the connection closes. On the machine side, traffic arriving through the tunnel is passed to the Ewon's LAN, with address translation by default.
M2Web is the browser-based alternative, which HMS positions for accessing machine KPIs and alarms without installing eCatcher.
Security controls documented by HMS
HMS documents several controls. Review them before you assess the risk.
- LAN firewall levels. The eCatcher help on active connections describes two levels. At Standard, "no firewall is applied" and connected users "have access to all devices on the LAN, to the Ewon gateway and to the Ewon itself". At High, only declared LAN devices are reachable on specified ports, while "the Ewon itself and its gateways remains unfirewalled".
- Users, groups and pools. eCatcher lets administrators create users and define user rights with groups and device pools. HMS's Talk2M plan comparison lists advanced user rights management on the Pro tier.
- Connection log. HMS says Talk2M administrators can see which user initiated a connection, when, for how long, and to which Ewon.
- Physical control. The whitepaper recommends a key switch or HMI button so that the end user keeps physical control over when remote access is possible.
- Certification and testing. HMS's secure remote access page states ISO 27001 certification and an IEC 62443 assessment by the independent firm NVISO, and says Cosy+ gateways include a secure element chip as a hardware root of trust.
- Hosting. The Talk2M terms of use say the Light and Pro service level agreement covers servers hosted in Europe, the USA, Japan and Singapore, on first-class hosting providers.
We did not find three things in public documentation. The first is recording of session content, such as a screen recording or a record of the commands sent to a PLC. HMS documents a log of connections only. The second is the names of the hosting providers. The third is federation of Talk2M accounts with a corporate identity provider. If any of these matter to your review, ask HMS directly. Do not rely only on this post or on our Talk2M alternatives post, which covers the identity question in more detail.
Three security questions to ask about Talk2M
The points below are not vulnerabilities. They are facts about the architecture, and each one answers a question that an operator or an auditor will ask.
Who operates the broker?
HMS operates the broker. Every connection goes through Talk2M, and Talk2M runs on HMS's infrastructure. This has a real benefit: you need no inbound rules and no server of your own. It also creates a dependency. Remote access to the machine requires the Talk2M service to be available and reachable, and the service is a third party in your access path. Supply-chain security reviews require you to document and assess that third party, and HMS publishes material that helps with the assessment. For your own plant, as opposed to a machine builder's fleet, decide whether you want this dependency.
What can a connected user reach?
The user reaches a network, with or without a firewall. At the Standard firewall level, the documentation says the user reaches every device on the Ewon's LAN. At High, the user reaches declared devices on specified ports, plus the Ewon and its gateways. In both cases, the user gets access to a set of IP addresses and ports on the machine's network through a VPN. The user does not get one application session to one asset. The limits depend on who configured the firewall level and the device list, and on whether anyone reviews them.
The risk is highest when the machine's LAN is not isolated, for example when the Ewon's LAN side is connected to a wider plant network. HMS's whitepaper presents the router as a logical separation between the machine and the factory LAN. This separation works only when the Ewon's LAN side is the machine network and nothing else.
What is recorded?
According to HMS, Talk2M records who connected, when, for how long, and to which gateway. This log shows whether anyone was connected. It does not show what the user changed on the PLC. If your incident response team or your auditor needs that information, you need another source for it.
How to add a control point on the plant side
A machine builder who services machines on sites they do not own often chooses Ewon, and some sites accept no other tool. An operator who runs their own plant needs to decide what sits between the Ewon's LAN side and the rest of the network.
Trout Access Gate is an on-premise appliance that can sit behind the Ewon. The Ewon and Talk2M stay in place, and Access Gate adds micro-segmentation of the LAN and a bastion. Each session that arrives goes to one authorised asset over one authorised protocol. The user authenticates with MFA against your identity provider. Access Gate connects several directories at once, so the machine builder's engineers can use a second Active Directory or the directory built into Access Gate, separate from your staff directory. Each session has a time limit and is recorded, and the plant behind the gate is segmented. The gate runs on your network, with no inbound exposure. We lay out the side-by-side in Access Gate vs Ewon and Talk2M.
For the general version of this question across all remote access methods, see secure remote access to a PLC. For the HMI and SCADA cases, see HMI remote access and SCADA remote access.
Five steps to take this week
- List every Ewon on site, with the Talk2M account it belongs to and who administers that account: you or the machine builder.
- Check the firewall level on each. Standard means every device on the Ewon's LAN is reachable. Move to High where you can, and review the declared devices.
- Check what the Ewon's LAN side is connected to: the machine only, or the plant network.
- Review the users. List who has access through each account today, check whether two-factor authentication is on, and confirm that each user still needs access.
- Decide what needs recording. If a log of who connected is not enough, plan how you will record what each user did.